Also you may send email from any address you want if you put it in the “MAIL FROM” SMTP transaction.
Thankfully the Linux kernel project accepts only signed commits.
Linus Torvalds did not commit this
21–30 of 198 posts
Re: Linus Torvalds did not commit this
#22There is a huge UX problem with validating the legitimacy of anything online. I have to know that credentials are available, and I have to know that it's possible to validate them. How do I even know if a particular set of credentials are legit? I'd have to know where to find validation for them. That's a whole other ball of wax in itself.
And we default to not requiring such authentication because the means we have are either completely useless (i.e. passwords) or so onerous (I always have to Google when I setup cryptographic credentials on anything, and we expect lay users to do this?) that they ruin adoption rates for software and services.
State-of-the-art secure credentialing should be as easy as passwords. Easier, even. Yet they're currently as "easy" as configuring Apache.
Re: Linus Torvalds did not commit this
#23Earlier quoted context omitted.
So, when submitting to your project it can happen that I'm afterwards blamed for things I didn't do? (Or praised)
That's the problem with all these guys obsessed with clean commit history.
What's wrong with having a clean commit history?
I think it's something people take too lightly.
Re: Linus Torvalds did not commit this
#24Yeah this is known, and you can get yourself an awesome list of contributors if you want: https://github.com/zixan/uberfareestimator/graphs/contributo... I think github should allow me as a user to confirm contributions made out of the system, at least the first time per repo.
That's a great solution. People should tweet it at Github and see if they implement it.
Re: Linus Torvalds did not commit this
#25So it seems the author has identified a real issue here, but I will go meta on this and identify issues with his demonstration. In my organization this would count as a bug report, so I wondered why this issue was not communicated privately to the operators of Github so they can have a chance to fix it before some un-educated person does some damage. Then I realized this issue might affect other git content hosters, so going public might alert them as well as forcing Github to fix it. Regardless, would the best approach not be to communicate privately first and allow Github to fix it before going public? If this was raised privately and not acted upon, then why are Github's internal processes so slow? So many questions, so little time...
Re: Linus Torvalds did not commit this
#26Re: Linus Torvalds did not commit this
#27Earlier quoted context omitted.
So, when submitting to your project it can happen that I'm afterwards blamed for things I didn't do? (Or praised)
I'm not sure I follow? All of your work is intact and committed as you, it's just done as a single (squashed) commit instead of N commits. The only difficulty that potentially arises (that we've encountered so far) is a lack of granularity for commit messages, which is why we try to keep PRs very small and focused.
I think what johannes1234321 is concerned about is that while you say the work is intact, he can't actually vouch for that because he didn't do it. You did. Which means that he could potentially be blamed (or praised) for something he didn't do in the event that you don't keep his work intact (intentionally or otherwise).
Re: Linus Torvalds did not commit this
#28Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables. I guess it's worth noting here that you can sign your commits with GPG: https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work
Similarly, nothing stops you altering the time claimed in the commit. Or -- for that matter -- from taking someone's diff and claiming credit for it. For that reason, I jokingly created `git-upstage`, which streamlines the process of abusing commit edits and plagiarizing code! It squashes a branch, backdates it 5 minutes, and claims you wrote it. https://github.com/SilasX/git-upstage Edit: Looks like my last commit l…
I love this. Had a project in college that was supposed to be time limited... based on repository times. Oops. Big mistake prof. We rolled back the times on our repo and laughed maniacally about our free 6 hour extension.
Re: Linus Torvalds did not commit this
#29I can imagine a scenario where a malicious employee is intentionally injecting malicious code (backdoor, whatever) and wants that commit tied back to someone else (their enemy, boss).
If they have push access, would github log who actually pushed it (i.e. ssh key)?
Re: Linus Torvalds did not commit this
#30One workaround would be to remove any public email address you commit under from your Github profile. Github uses these email addresses to tie back to your user profile so if you don't want commits pointing at your profile, don't tie email addresses to your profile.
Perhaps some mechanism is called for here for approving tying back to your user on new repositories or making any repository not owned by you or your organizations require an explicit opt-in to tie back to your profile.
Edit: This is kind of the equivalent of spoofing the From address in an email.